Extracted

• • Target
    34edad17891c9f89b8f3ee85e14e4e40ceed562d78563c0597720eb556a0e9c2.JS.js
  • Size 3.3MB
  • SHA256 34edad17891c9f89b8f3ee85e14e4e40ceed562d78563c0597720eb556a0e9c2
  • MD5 217a01b35777226f65042ef252e030c2
  • SHA1 c2a64255bef8126b906b2e673c2e9e03f581a767
  • SHA512 1b911dad0e495593d93ea11676dbbdddfac74344fa30b48ffcbcb280825f6855087f4a31700daa5dcd3b56ec0ae603a653c7ae49806ef8eab85f820236e81068
  • SSDEEP 98304:Rl2ueTEfM5ZXcMWSW/b5NuF/uTH632oSNdaEvVNNXuoYjJzKpOBvFmzCZ3PLRWAi:D/eThKFSG5NuNuTcSz9vBNOzAOBvFBu
  • TLSH
    T1BFF53A41175A9432AB6DD75CD136E930A98E201315CADF2D306ED33C3A10E5B63AEEE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagenttesladonutloaderkeyloggerloaderspywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2